40230 matches found
EUVD-2026-62604
Orval: Import-time RCE via query parameter name - computed-property-key injection in the zod cli...
EUVD-2026-62602
Orval: Import-time RCE via header parameter name - computed-property-key injection in the zod client...
Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-151)
Improper Control of Generation of Code in Kibana Leading to Privilege Escalation An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side scrip...
CVE-2026-85137
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...
CVE-2026-85137 SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...
EUVD-2026-70519
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...
CVE-2026-85137 SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...
CVE-2026-85137
SeaCMS up to 13.6 is affected by a code injection vulnerability in the parseIf function within the file seacms_locoy_news.php, part of the Locoy Collector component. The flaw is triggered by manipulating the pwd argument, allowing remote attackers to inject and execute arbitrary code without auth...
PT-2026-85022
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...
CVE-2026-85137: Improper Control of Generation of Code
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...
Fedora 45 : dracut (2026-5bf73fe397)
The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5bf73fe397 advisory. - fixdevicetree-firmware: include soc specific firmwares in installgeneric - fixdevicetree-firmware: include Qualcomm X2 laptop model specific firmwares -...
TencentOS Server 3: perl-DBI:1.641 (TSSA-2026:0971)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0971 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
PT-2026-85075
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms locoy news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...
Exploit for Code Injection in Langflow
P...
EUVD-2026-62600
Orval: Import-time RCE via query-parameter default - zod module-level template literal...
GHSA-6MR6-JVCR-2F25 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
Summary orval's zod client emits each schema property name as a double-quoted key in the generated zod.object... WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key expr is evaluated when zod.object...
EUVD-2026-62596
Orval: Import-time RCE via schema property name - computed-property-key injection in the zod client...
Malicious Package
Overview bella-lontong60-breki is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Arbitrary Code Injection
Overview modelscope is a ModelScope: bring the notion of Model-as-a-Service to life. Affected versions of this package are vulnerable to Arbitrary Code Injection due to unsafe YAML deserialization in the model configuration loading paths in modelscope/models/audio/tts/voice.py and...